Read the docs
TI-2026-47516 Aliases CVE-2026-67193GHSA-3c72-cvwm-9gqx

Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

Priority LOW 37CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-203.

Summary

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Fixed Xlight FTP Server (Xlight): 3.9.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XlightXlight FTP Serverbefore 3.9.53.9.5Patch availableCNA
  • Xlight FTP Server VendorXlight Affected before 3.9.5 Fixed in 3.9.5 Patch available CNA

Remediation

  • Fix · CNA Xlight FTP Server (Xlight) Fixed in 3.9.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Xlight FTP Server 3.9.5

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-47515 Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM CipherPriority MEDIUM 44
    • TI-2026-47514 Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH ParserPriority MEDIUM 44
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67193
  2. 2026-10-03 Alias added: GHSA-3c72-cvwm-9gqx

References

Other 1

  • TI-2026-47515 Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher CVSS 4.0CRITICAL 9.2
  • TI-2026-47514 Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences